chore(deps-dev): bump worker dev dependencies past the sharp advisory

[kim-em]

This PR bumps the worker's dev dependencies to current and pins sharp to a fixed release, clearing every advisory that npm audit --audit-level=low reports.

npm audit had gone red repo-wide on advisories published since the last run of ci.yml on main. Bumping vitest to 4.1.11 clears the two moderate @vitest/mocker path-traversal findings. The four high findings are the libheif vulnerabilities in sharp below 0.35.4, reached through miniflare. A top-level wrangler at 4.136.1 resolves miniflare 5.20260921.0-alpha and sharp 0.35.4 on its own, but @cloudflare/vitest-pool-workers 0.22.0, the newest release, hard-pins wrangler 4.124.0 and miniflare 5.20260815.0-alpha, which carry sharp 0.35.2. No published version of the pool package resolves that, so the overrides entry forces the fixed sharp into its subtree as well. The override can go once Cloudflare ships a pool release built on a current miniflare.

worker-configuration.d.ts is regenerated, since wrangler types output moves with the wrangler version and CI asserts the committed file matches.

This supersedes the four open Dependabot bumps, #43, #45, #57 and #58; #57 in particular stops short at wrangler 4.127.1, inside the advisory's 4.16.0 to 4.130.0 range.

🤖 Prepared with Claude Code